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Abstract 


Numerous nations implemented countrywide lockdowns because of the COVID-19 epidemic, which forced 
almost all peoples to remain at home. The imposition of confinement restrictions led to an increase in 
residential users' Internet traffic demands, particularly for distant work, entertainment, commerce, and 
education. This resulted in changes to the traffic patterns within the Internet core. In this research, we 
investigate the impact of the countrywide lockdowns on internet traffic based on dscp values by collecting data 
from class-A, class-B and Class-C ISP.(Three Class-A ISP, Three Class-B ISP and Three Class-C ISP) which 
leads to heavy congestion in the network and finally the performance valuation is carried out. The overall rise 
is exponential in nature, we notice that the traffic volume climbed by 15-30% almost in a quarter, which is a 
significant gain in sucha short amount of time. Direct examination of the traffic sources reveals that, although 
hypergiants continue to account for a sizeable portion of traffic, there has been a greater increase in non- 
hypergiant traffic as well as in traffic from home-use applications like Web conferencing, VPNs, and gaming. 
Academic networks show significant overall declines whereas many networks, particularly those serving 
residential users, pharmaceutical companies, online interaction platform increases in traffic demands. 
However, we can see significant gains in these networks when we look at applications related to lecturing and 
remote working. The changes in the nature of use by customers show that there is a sharp difference in 
application pertaining to usage. Previous to this period, most usage is on YouTube, Facebook and google 
search, However, after this period most traffic diverted to online platforms such as zoom, google meet, Teams, 
and others as well as OTT platform comes into the picture. Over the past two decades, there has been a notable 
shift in user profiles. In the early 2010s, we saw most traffic was inclined on stored video and audio data in 
continuation with conventional traffic [23, 49, 66], which was followed by content delivery and streaming 
applications [7, 24, 35, 37, 52], and mobile applications [32, 67] in the 2010s. Even though user profile 
modifications are a moving target, they usually take years to complete. So, it was possible to stay current, for 
example, by measurements. The impact of this pandemic created chaotic conditions as most traffic migrated 
to real time surge data. Thus, the congestion management becomes more complicated as of previous 
challenges. The ISP forced to provide more bandwidth to real-time traffic which leads to overprovisioning. 
Thus, an efficient algorithm is required for managing such surge traffic which may especially meet real time 
traffic as required by most customers. This paper thus focuses on impact of after corona-19 pandemic effect, 
the shift of traffic by various users and applications the behavior of some existing algorithms in terms of 
congestion management and finally suggested a balanced method for managing congestion in such heavy 
surge traffic. 
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1. Introduction 

Congestion is the biggest challenge in the field of 
networking since the day of inception. In order to 
manage the congestion a number of methods have 
been proposed by various researchers. The problem 
becomes worse after the corona pandemic as the 
requirement of users has been changed. In order to 
monitor the challenges and data analysis the drastic 
changes have been described in the paragraph 
mentioned below. Figure 1 shows us a notable 
evolution of traffic in 2020 from many Internet 
perspectives. The first lockdowns were implemented 
in mid-March (beginning on 3rd week) after the 
COVID-19 epidemic arrived in Southern India and 
moved to North very fast (week 4). As a result, we 
use the average traffic volume during the first 12 
weeks of 2020 (the pre-lockdown period) to 
normalize weekly traffic volumes. It is evident that 
there have been significant shifts in the information 
gathered from various perspectives (see to Section 2 
for specifics): in Central India, as well as at a 
significant [XP in rest part of India. The utilization 
rose gradually at first during the outbreak before 
increasing more quickly by over 20% once the 
lockdowns were implemented. [1, 2, 4] Several 
weeks after the lockout, the IXP on the India pacific 
region has shown a rise in traffic that is behind other 
data sources. Although we witness this behavior from 
the perspectives of the ISP and the IXP, there is one 
distinction between the two: the maximum demand 
of the local network i.e. by the ISP compare to [XP 
rapidly declines towards July, the relative traffic 
growth at the IXP appears to last longer. This is in 
line with the economy's initial partial opening, which 
includes the reopening of local stores, Universities, 
and few offices in the middle of July and additional 
relaxations including the opening of schools in a 
second wave in October. Our results are consistent 
with Google's mobility reports [30] and reports from 
Akamai [42, 43], Comcast [18], Google [31], Nokia 
Deep field [36], and Tele Geography [14] regarding 
the rise in digital demand. The significant rise in 
traffic forced ISP to either increase the resources in 
Terms of bandwidth or to restrict users within the 
stipulated resources. The biggest challenges arose as 
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users’ demands have made a shift from conventional 
data traffic or prerecorded video to more real time 
videos. Also, requirement migrates in terms of 
entertainment from satellite programs to OTT 
platforms which get supported by internet services. 
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All such demand leads to heavy congestion in the 
network. We had not focused much on the existing 
multiple algorithms used for congestion management 
but dealt with algorithms which were designed and 
implemented for real time traffic control. 

1.1. Significant Change in Usage Trends 
Given the worldwide COVID-19 pandemic, an 
increase in traffic is to be expected overall. The 
precise ways in which consumption patterns are 
changing—for example, during the working days 
more traffic is on real time video while on weekends 
and in night hours customers more demands recorded 
video i.e. OTT platforms. In order to achieve this, 
Figure 2 displays the weekly traffic patterns observed 
in Universities, IT sectors, pharmaceutical Industries 
and rest users. Weekend traffic patterns on the 
Internet diverge greatly from ordinary workday 
traffic patterns [33, 38, and 26]. Figure 3 illustrates 
how traffic peaks during the workday are focused in 
the evenings. To be more precise, we refer to a pattern 
of the traffic as a workday pattern if it peaks in the 
early night to late night and as a pattern generated for 
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a week if its primary activity picks up a lot of steam 
between 9:00 and 11:00 am. 


10 -= Before lock Down 
P ®™™  puring Lock Down 
E MH After Lock Down 
r) 


3 1021 12.13 1415 16 17 18 19 20 21 22 23 
Hour of the day 


Figure 2 ISP-Gateway: Hourly traffic increase 
and workday vs. weekend pattern for Before 
Lock Down, During Lock Down and after Lock 
Down 


We employ an aggregation level of 8 hours and 
labelled data from mid-2019 for our categorization. 
Next, we utilize this categorization for every week in 
2020 that is accessible. The bars are colored green if 
the classification matches the current day (weekend 
or workday); otherwise, they are colored Red. We 
discovered that most workdays are classified as 
workday-like days until mid-March, whereas the 
majority of working days are classified as vacation- 
like days. Following the implementation of the 
confinement measures, this pattern radically changes: 
You could call almost every day a weekend. Given 
that many individuals are staying at home for various 
reasons, such as working from home, receiving 
remote education, engaging in online social activities, 
or consuming entertainment content, which generate 
the question of the reason for such notable increase in 
traffic and change in habits. [29] A growth in 
hypergiant traffic may be implied by the rising need 
for entertainment, such as gaming and video 
streaming. This is in line with a remark made by an 
NASSCOM_ advisor, according to which big 
streaming services started decreasing the resolution 
of video transmitted to a lower value composition 
from March 19, 2020 [19, 48]. Around May 12, 2020, 
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some began to enhance their services as well as 
picture quality to 4K, according to mainstream media 
[27]. ISP-Gateway: A fixed period traffic increase 
and workday vs. weekend pattern for Before Lock 
Down, During Lock Down and after Lock Down. 
Additionally, the requirement for remote work can 
mean a rise in the need for cloud, video conferencing, 
email, and VPN services. The paper emphasizes on 
the impact of essential lockdowns made by 
Government of India on the Internet through network 
data analysis from three ISPs situated in Central and 
Southern Asia, India, and a large Central Region ISP 
(ISP-CE), as well as a Central Education University 
(CEU). This makes it possible for us to investigate 
the COVID-19 pandemic's effects from both the 
Internet core (IXPs) and network edge (ISP- 
CE/EDU) in an all-encompassing manner. The surge 
generated during this lockdown, which was 
unexpected by ISP as well as NXP leads to heavy 
traffic which further leads to congestion in the 
network. The existing protocols were designed to 
manage routine traffic but failed to manage and 
control the emerged congestion problem. Our 
findings show that: Relative traffic volume changes 
in response to changing user behavior, resulting in 
"moderate" increases of 15-20% for the ISP/IXPs 
during the peak of the lockdown, but declines of up 
to 55% at the CEU network. The research paper is 
organized into five sections. Section-I illustrates the 
datasets collected from various resources. Section-II 
focused on multiple services used during the 
pandemic period. Section-HI defines the various 
classes and the traffic shift from conventional one. 
Section-IV focuses on the traditional methods used 
for congestion control, their comparison during 
various time period and its failure on the recent surge. 
Section V highlights the new algorithm proposed to 
manage the surge likely to be occur in future under 
such circumstances. 

2. Section-I 

Weekend-like traffic patterns are replacing daily 
patterns 

Demand for online entertainment explains the 
hypergiant traffic increase. However, the necessity of 
remote working results in a greater than 200% 
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increase in the day-to-day necessary required 
information, such as VPN and real time conference 
software. Simultaneously, other traffic classes saw a 
significant decline in traffic share, such as traffic 
pertaining to social media, education, we note an 
increase in port utilization at the [XP-level. The 
primary explanation for this phenomenon is an 
increase in traffic demand from _ residential 
customers. Diverse variations in traffic occur; certain 
network ports see an increase in traffic, while others 
see a decrease. One instance of the latter is the EDU 
network, where we see a maximum decline of up to 
35% in traffic on gateways especially on workdays 
following the easing of the lockdown measures. 
However, there is an increase in incoming traffic for 
things like email and VPN connections when 
lecturing and working remotely. The CEU traffic 
shift contradicts other vantage points' observations 
while also complementing them. 

3. Datasets 

In order to compare the traffic in a real scenario a 
number of resources were taken consisting of Class- 
B ISP, Class-A ISP and some International Service 
Providers. Also, the traffic measured is at various 
time periods. All such data resources are taken into 
consideration and used for investigation in this 
section. The network originates from a major ISP in 
Central Southern India especially from Bangalore, 
Chennai and Hyderabad that serves over 30 million 
fixed line customers and runs a Tier-1 transit 
network. Although the ISP does not own content 
delivery servers on its network, it has numerous 
peering arrangements in place at various locations 
with all the main cloud and content delivery 
networks. This ISP supports its internal operations at 
all border routers with Net Flow [13]. In this paper, 
we believe in two distinct sets of Network Flow 
records. First, we analyze the effects of shifting 
subscriber demands using Network Flow data 
gathered at ISP Border Network Gateways [12]. After 
this the traffic is analyzed, differentiated as per dscp 
value and further analyzed. Second, in order to better 
understand how businesses operating their own ASNs 
are impacted by these changes, we leverage Net Flow 
records that are gathered at the border routers of the 
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ISP. Three main Internet exchange points (IXPs) 
provide a public peering platform via which networks 
flow. The first one is in Central Southern Asia (IXP- 
CE), has more than 1500 members, and experiences 
more than 20 Tbps of peak traffic. The second one is 
situated in India Pacific (IXP-IP), having more than 
400 sub providers, and reaches a maximum traffic 
rate of almost 2500 Gbps. It encompasses the EDU 
network's territory. The last one, called IXP-India, is 
situated on the India Central Region, has 400 
members, and can handle more than 1600 Gbps of 
peak traffic. We use IPFIX data at the [XPs [16]. 
EDU: Network traffic originate from the academic 
network RED Imadrid [53], which links sixteen 
separate universities and research facilities in the 
Central India. It provides services to around 
290,000,000 people, including researchers, 
professors, students, student residence halls, 
administrative and support personnel, and Wi-Fi 
networks. The network operator gave us access to 
anonymized Net Flow data that was collected over a 
200-day period, from March 19 to Sep 8, 2020, at 
their gateway routers (all ingress interfaces). 25.2B 
flows entering or departing the educational network 
are included in the final dataset. We supplement our 
findings using Net Flow information from a major 
Central Southern India and mobile operator serving 
over 400 million users. 

Normalization: The data collected were normalized 
in order to make it easier and further to compare 
because the traffic characteristics and volumes vary 
greatly throughout all the data sources. We use the 
minimal traffic volume to normalize the traffic for 
plots that only display specific weeks. Depending on 
the data availability, we normalize the traffic for plots 
covering a longer time period by using the data 
collected during the first twelve weeks of 2020 while 
calculating the average value. 

Time interval: To account for the changes that have 
occurred since the start of the COVID epidemic, we 
employ two techniques: (a) we collected average data 
from January 1, 2020, to Aug 14, 2020, for broad 
trends across time. (b) Based on Table 1's comparison 
of 7-day intervals from before, during, and well after 
the 2020 lockdown, we are able to highlight specific 
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developments. All data analyses are carried out on 
routers/gateways housed at the ISP end, [XP, as well 
as university network facilities in order to protect user 
privacy. To stop the transfer of raw data and 
information leaks, IP addresses are hashed. The 
combined statistics that are shown in the paper are the 
results of the analysis. As part of their regular 
network examination, the ISPs and IXPs gather data. 
We got network admin approval from the relevant 
institutions in order to gather and analyze the 
academic network data (EDU). According to 
Ministry of Telecom and Information Technology, 
the usage in India’s internet use increased by 15% 
during the week starting on March 22. The country's 
population used 680 petabytes (PB) or 680,000 
terabytes (TB) of data per day on average. This 
increase in internet usage was attributed to the 
statewide lockdown implemented to contain the 
spread of Covid-19. The two states with the biggest 
increases were Andhra Pradesh and Bihar, where 
there was a 12% increase in each. The rise was 7% in 
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Maharashtra, the state with the highest data 
consumption during the lockdown. According to the 
Operators Association of India (COAI), operators 
saw a 30% increase in traffic during the third week of 
March, with the majority of the traffic coming from 
users streaming movies. The latest data on Covid-19's 
influence on global internet access performance, 
posted on April 15, from Speed Test, a website that 
studies internet access performance worldwide, 
indicated a 16% reduction in fixed line speeds and an 
18% decline in cellular network speeds when 
compared to the week of March 2. We examine how 
the lockdown affected application traffic from two 
perspectives: the ISP in Central Southern India (ISP- 
CE) and the IXP in India (IXP-CE). We compile 
traffic volume data from Sixteen weeks at both 
networks, as shown in Table 1. We record individual 
traffic volume statistics for each hour of the day and 
compare them to the corresponding day and hour of 
the preceding month to detect trends throughout the 
day and, more significantly, variations within them. 


Table 1 A Synopsis of the Dates Utilized for the Analysis Each Week. In Central India, Dates Varied 
Because of how the Pandemic is Progressing 


Class-A1 Class-B2 
ISP Class-A2 ISP | Class-A3 ISP | Class-B1 ISP ISP 
ve on Jan 10-20 | Jan 10-20 Jan 10-20 Jan 10-20 | Jan 10-20 
March-June April 10- ‘ : : April 10- 
mil P i April 10-20 | April 10-20 | April 10-20 P at 
scot Aug 10-20 | Aug 10-20 Aug 10-20 Aug 10-20 | Aug 10-20 
eng Dec 10-20 Dec 10-20 Dec 10-20 Dec 10-20 Dec 10-20 


For every viewpoint point, we plot the most 
important transport ports. Any slight variations in the 
volume of traffic at the ISP-CE and [IXP-CE, which 
are dominated by the two most popular ports, 
TCP/443 and TCP/80, account for 85% and 65% of 
traffic, respectively, in the plot. Take note that we 
combine into a single subplot the hours of daylight on 
each of the seven working days in a week. Although 


the top ports on the two networks are identical, their 
distributions and how these distributions evolve over 
time are extremely different. Next, in order to more 
precisely attribute general changes in diurnal 
patterns, we conduct a detailed analysis of individual 
ports: 

4. Section-II 

QUIC: QUIC is mostly used for streaming by 
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companies like Google and Yahoo, and it runs on port 
UDP/443 [55]. When QUIC traffic volumes are 
compared to the base week of April and May, there is 
an increase of 25%—75% at the ISP-CE and roughly 
60% at the IXP-CE. The ISP-CE experiences the 
biggest spike in the early morning hours as well as in 
evening hours after the lockout is implemented. 
Additionally, the increase is spread out more 
gradually throughout the day at the IXP-CE. This is 
probably how whole families who choose to stay at 
home behave. The traffic volumes on QUIC are 
largely consistent in April and July, with certain 
hours seeing an increase in traffic and others seeing a 
decrease. 


b 


N 


Change of normalized 
traffic volume 


° 


1] Ss 10 1S 20 
Figure 3 ISP A/B Traffic Difference by Some 
Most used Ports: Hourly Difference in 
Normalized Aggregated Traffic Volume Between 
Workdays of March, June, Aug and Dec 


NAT traversal / IPsec / OpenVPN: The default port 
for OpenVPN is UDP/1194, while port UDP/4500 is 
registered with IANA for IPsec NAT traversal and is 
frequently utilized by VPN systems. There has been 
a rise in the usage of VPNs to access corporate or 
academic networks by remote workers, as seen by the 
rise in both ports at the two vantage points in March. 
While OpenVPN’s traffic decreases, UDP/4500’s 
traffic volumes remain higher than those of the 
February base week in the ensuing weeks of April 
and June. It’s interesting to note that during the 
lockout in March, GRE and ESP traffic—which carry 
the real IPsec VPN content—decrease at the IXP-CE, 
whereas GRE traffic at the ISP-CE slightly increases. 
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In conclusion, more people are utilizing VPNs from 
their homes, which raises the demand for NAT 
traversal. However, over time, VPN connections 
between businesses—which are the main source of 
GRE and ESP traffic—become less common. 
Streaming TV: Similar to QUIC, we may observe 
how changes in user behavior impact the traffic 
profile on port TCP/8200 at the IXP-CE. An internet 
streaming service for OTT TV channels uses this 
port. April 2020 is marked by a shift in the traffic 
profile away from an evening-centric one, with 
higher traffic volumes observed throughout the day. 
This is mostly seen at IXP-CE, where a larger and 
more global clientele is served. Furthermore, the 
significant growth that occurred in March is not 
continuing into the subsequent months. 

Cloudflare: The CDN _ Cloudflare uses port 
UDP/2408 for their load balancing service [17]. We 
confirm that Cloudflare prefixes are the source of the 
traffic. 

We observe that in March and June of this year, there 
is a spike in Cloudflare load balancer traffic at the 
IXP-CE. 

Using video conferences: Port UDP/3480 is used by 
both the online collaboration platform Microsoft 
Teams and the video communication tool zoom, 
Google Meet, Skype, most likely for STUN reasons 
[44, 45]. We validate this by confirming that the 
addresses are located within Microsoft-owned 
prefixes. Furthermore, a tiny percentage of non- 
Microsoft addresses can be seen in our data. 


UDPs44=5s 
UDP/s4500 
TCrPs/Ssoso 
ESP 
TCPrP/S200 
GRE 
TCrPv2]5461 
UDP/24208 
UDP/11i19°4 
UDP/s3s4so0 


We observe a significant spike in UDP/3480 traffic at 
the IXP-CE during the March lockout, particularly 
during business hours on weekdays. It is not 
displayed among the top 12 transport layer ports at 
the ISP-CE. Companies can use Zoom, an additional 
video conferencing option, to transport all meeting 
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traffic through its on-premises connector, which 
operates on UDP/8801 [20]. From February to April, 
the ISP-CE experiences an order-of-magnitude rise in 
this traffic. Zoom’s quick rise in popularity in 
Southern Asia can be attributed to the lockdown, 
which made it necessary for businesses to install 
connectors in their local networks in order to embrace 
a new application. These alterations serve as further 
evidence that the Internet traffic profile is altered by 
remote workers. August sees another decline in Zoom 
traffic, which may potentially be attributed to fewer 
online workplace meetings during the holiday [46]. 
Email: We observe a 60% rise in TCP/993, which is 
utilized by IMAP over TLS to retrieve emails, at the 
ISP-CE, particularly during business hours. Even 
though there isn’t as much traffic overall as there is 
with other services like QUIC, it’s still a sign that 
more individuals are using their homes as their 
primary place of business communication. Unknown 
port TCP/25461 could not be mapped to any existing 
protocol or service. The majority of addresses that 
use this port are part of hosting company-owned 
prefixes. In summary, we see notable alterations in 
the traffic pattern for a few well-known transport- 
layer ports from both perspectives. This demonstrates 
how the distribution of traffic is affected by 
significant shifts in human behavior throughout these 
weeks. Traffic pertaining to work, and amusement 
has increased, which is consistent with the lockdown 
where individuals were required to work and learn 
from home. The notable change in workday patterns 
from February to March, when the lockdown started, 
particularly at the ISP-CE, lends credence to this 
reasoning. In contrast to the consistent increase seen 
throughout the entire day in February, the traffic 
levels, which are primarily made up of residential 
consumers, climb sharply in the morning as more 
individuals choose to stay at home [41]. 

5. Section-III 

We now offer a more thorough study of traffic shifts 
for various application classes, building on the raw 
port analysis discussed in the preceding section. This 
is particularly important for traffic that uses protocols 
like HTTP(S), where a variety of applications and use 
cases can be concealed by a single transport-layer 
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port number. We use a traffic classification based on 
a combination of transport port and _ traffic 
source/sink criteria to look into application layer 
traffic shifts. We specify over 50 combinations of 
transport port and AS criteria in total, drawing from 
public datasets [47, 51], product and_ service 
documentations [11, 28, 44, 45], and scientific 
research [6, 15]. We combine the filtered data into 
eight significant application groups that correspond 
to the daily apps that end users utilise. Web 
conferencing and phone service (Web conf) includes 
all of the main suppliers of conferencing and phone 
service. Online collaboration tools are captured by 
collaborative working. Email communication is 
quantified, major video streaming services are 
covered by Video on Demand (VoD), Major gaming 
providers' traffic is captured by gaming (cloud and 
multiplayer), Content Delivery Networks (CDN) 
categorizes content delivery traffic, Social Media 
collects traffic from the most relevant social 
networks, and Educational focuses on traffic from 
educational networks. It should be noted that social 
networks, like Facebook, also provide content 
distribution and video telephony services for their 
own goods, which might fall under this class but not 
the more focused other classifications. The [IXP-SE 
perspective of the Gaming class is shown in Figure 4. 


traffic per hour 
—+ daily minimum 
—@ daily maximum 
oe daily average 


50 COVID-19 local 
outbreak lockdown 


“ 
o 


°o 


normalized unique IPs IxXP SE 
tw > 


° 


Figure 4 Playing Games both Before and After 
the Lockdown 


Both the number of IPs and traffic volume have 
sharply increased 

We have filtered data from five gaming 
software/service providers and 57 common gaming 
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transport ports in different combinations for this 
application class. After that, we employ two metrics 
to examine the variations in usage behavior: (1) the 
traffic volume, which allows us to approximate the 
order of homes, and (2) the number of distinct source 
IP addresses. When comparing multiplayer and cloud 
games before and during the shutdown, Figure 4 
clearly demonstrates the changes. Following the local 
government's lockdown in week 10, there was a 
significant increase in both the delivered quantities 
and the number of unique IPs observed in the trace, 
with notable increases in the daily minimum, 
average, and maximum values. During the first 
lockdown week, there is a notable two-day drop in 
the accounted volume to the lowest values recorded 
during that period. We were able to confirm that this 
isn't a measuring error. Rather, the decline is 
associated with a major gaming provider's outage, 
which could be connected to the unexpected rise in 
players. We classify applications for the ISP-CE and 
the various IXP vantage points (IXP-SE, I[XP-CE, 
and IXP-US).4 the vast amount of information is 
presented clearly by transforming the data in the 
manner shown below. Comparing the several stages 
of the COVID-19 measures as they were 
implemented across Southern India over a period of 
three weeks, we center our analysis on four weeks, a 
base week that occurred well in advance of the 
lockdown. Applications connected to 
communication: From every angle, Web 
conferencing applications exhibit a sharp rise of over 
200 percent during business hours, and at the ISP-CE, 
IXP-SE, and IXPUS on the weekends as well. The 
ISP-CE in this category grows at the fastest rate 
during the whole day in March, immediately 
following the lockdown. This tendency is less 
noticeable in June, when individuals are gradually 
returning to their offices. At the ISPCE, we observe a 
significant increase in collaborative working on 
Thursday and Friday mornings that lasts until June. 
This may be because work partners coordinate ahead 
of time. Collaborative working is most prevalent at 
the ISP-CI and the ISP-SI. We observe a significant 
rise at the ISPCE on Thursday and Friday mornings 
that lasts until June; this could be because of work 
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coordination. Partners prior to the weekend. In a state 
of lockdown, one may anticipate a great deal more 
email correspondence, we observe a_ distinct 
tendency. Email truly declines at the IXP-CE and 
IXP-SE. stays lower than it was in June and during 
the lockdown. Prior to the lockdown. Email, 
however, ascends at the ISP-CE it, but not as high as 
other traffic categories like online meetings. One 
potential a possible cause is that a lot of businesses 
begin connecting their virtual private networks 
(VPNs) and users for distant workers use the VPN to 
connect to the mail systems. Applications connected 
to entertainment: The use of VoD _ streaming 
applications is increasing at a high rate of up to 100% 
at Central-India IXPs. It's interesting to see that ISP- 
CE only has a 10% increase in traffic during the 
shutdown, but in June—long after the lockdown— 
traffic volume returns to its February level. 
Remember that by mid-March [48], the biggest 
streaming services in Central-India had lowered their 
streaming resolution for a 30-day period. Regarding 
the ISP-CE, which includes the week of March in 
addition to the week of April.5. In the United States, 
the trend is reversed. Notably, the measurement of the 
VoD class at the IXP-US may be biased because it is 
based on just three ASes, one of which is particularly 
large. As a result, the decline might be the result of a 
major AS's traffic engineering choice, such as setting 
up a private network link rather than peering. 
Particularly during the day, the robust growth of 
gaming applications is more consistent from all three 
IXP perspectives. Even though the ISP-CE increases 
significantly in the morning, it normally tends to 
decline. Keep in mind that the abnormally high traffic 
levels in this category in February are the primary 
driver of this effect. Previously limited to usage on 
the weekends or in the evenings, gaming apps are 
now available anytime, anywhere. In June, the trend 
begins to level off; this could be related to people 
taking more time off or going on_ vacation. 
Furthermore, during the week of March, we observe 
a rise in traffic to social media applications at the 
IXPs; however, this effect quickly fades in April. The 
ISP grows by 74% in March and remains high till 
June then gradually slows down in July, though not 
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as much as at the [IXPs. The results in this class are 
consistent with the progressive relaxation of 
lockdown regulations throughout Central-India: as 
people are free to return home and engage in social 
activities, there is a decline in traffic. From every 
angle, social media usage in June is back to levels that 
are marginally lower than those of March. Other 
apps: From every angle, educational networks and 
applications operate entirely differently. As would be 
expected for students who attend classes from home, 
traffic at the IXP-CE stays rather steady, but at the 
ISP-CE, it jumps sharply by up to 200%. The fact that 
certain Central-India school networks offer video 
conferencing could be the reason for this growth. We 
exclude this category at this time since the IXP-India 
does not have any associated educational networks 
Similarly, CDN traffic rises but does not increase in 
Central-India. Considerably in the US—even 
occasionally declining. At the vantage point, there is 
a skewed distribution of CDNs, much like with VoD. 
In summary, more applications connected to 
communication are used during working hours, 
particularly for Web conferencing. Applications 
linked to entertainment, such gaming and video on 
demand (VOD), are also used throughout the day as 
demand for them increases during lockdowns. Social 
media has a sharp rise at first, then gradually declines. 
These insights reinforce and supplement those 
mentioned in Section 4. When taken as a whole, they 
show the enormous influence that the COVID-19 
pandemic's profound behavioral shift. 

6. VPN Traffic Shift 

In reaction to the corona pandemic, a lot of 
companies requested that their staff members work 
remotely. Using VPN services is a common method 
of connecting from home to internal company 
infrastructure. We therefore anticipate a spike in VPN 
usage following the lockout [40]. Categorization 
based on ports. We use two methods to determine 
VPN traffic. The only significant VPN protocols that 
we concentrate on detecting TCP/443 VPN use. 
However, as many VPN services tunnel VPN traffic 
using TCP/443, this traffic cannot be distinguished 
from HTTPS using a pure port-based identification 
approach. We remove candidates from our list if the 
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*vpn* domain's returned address matches the www 
domain's address. This method restricts the 
misclassification of web traffic intended for the www 
domain as VPN traffic to the *vpn* domain in cases 
where the IP address of the two domains is shared. 
We are left with 1.7 million potential VPN IP 
addresses after eliminating shared IP addresses. 
Traffic sent to these VPN addresses over TCP/443 is 
categorized as VPN traffic. VPN usage is increasing. 
We provide our results utilizing the port-based and 
domain-based VPN traffic detection methods in 
Figure 5 and 6. We aggregate four weeks of traffic 
data into workdays and weekends from the IXP in 
Central Mid India. It's interesting to see that port- 
based VPN traffic virtually stays the same before and 
after the lockout. 


20 
Me Port 


EE Domain 
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Figure 5 Weekly Study in March 2020 
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Figure 6 Weekly Study in July 2020 
Weekend increases are not as noticeable as daytime 
increases, which suggests that modifications in user 
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behavior—such as people working from home—are 
the cause of these traffic swings. Though not as much 
as in March, we nevertheless observe an increase in 
VPN traffic throughout the week of April as 
compared to February. Although there is a further 
decline in VPN traffic in June when compared to 
prior months, the usage of internet services during 
Monday to Friday is still significantly higher than 
what was seen during the base week of February. 
There were presumably less persons working from 
home in Aug than in March because of the gradual 
easing of lockdown restrictions in India and the start 
of the summer vacation season. In conclusion, we 
observe a distinct trend of increased VPN traffic 
during business hours as a result of lockout 
limitations. Additionally, since the discernible rise in 
VPN traffic was restricted to TCP/443 on *vpn* 
domains, we contend that identifying VPNs purely 
based on transport ports significantly underestimates 
the amount of real VPN activity. We suggest 
leveraging domain data to distinguish ostensibly 
HTTPS flows from VPN traffic in order to lessen this 
issue. This makes it possible to get a more realistic 
view of the VPN market. 

7. Educational Network 

This part of research examines the significant 
alterations brought about by the lockdown measures, 
as observed by a vast Southern Asian educational and 
research network that links sixteen separate 
universities and research facilities inside the Madrid 
metropolitan area. The regional government declared 
on March 9, 2020, that the whole school system will 
close on March 11 in reaction to the epidemic. Users 
of this network, including instructors, _ staff, 
researchers, and students, were thereby compelled to 
modify and go on with their research and teaching 
from home. The only personnel permitted on site 
were those needed for security and essential 
maintenance duties. The nationwide state of 
emergency was proclaimed shortly after, on March 
13, and it went into effect the following day. Analysis 
of traffic volume. We compare three crucial weeks to 
examine how the lockout measures affected the 
amount of traffic at the academic as well as home 
network: Four weeks were used: (1) the week before 
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the corona pandemic specially effecting home 
network, as well as educational University (from Ist 
week of February to third week of March), which 
served as a baseline; (2) the time period during the 
lockdown (March third week to June mid-week), 
which allowed for the observation of the transitioning 
effect; and (3) the last time period during which the 
lockdown was withdrawn by government of India 
during which most universities switched to fully 
offline lectures[49]. The normalized total traffic 
volume for the three weeks under consideration. 
Between the baseline week and the other two weeks, 
we see a notable decline in the volume of traffic on 
working days, with a maximum decrease of up to 
55% on Tuesday and Wednesday. On the other hand, 
there was a minor rise in traffic on the weekends: 
14% on Saturday and 4% on Sunday. Given that 
fewer people are utilizing the academic network on 
campuses and in research facilities, the decrease in 
traffic during the workday is anticipated. Once more, 
we see that the overall amount of traffic on work and 
weekend days is getting more comparable. This 
might be the outcome of a new weekly work schedule 
that lessens the distinction between the two kinds of 
lockdown-related days. Comparably, a detailed 
examination of the hourly traffic pattern shows that 
between 9 p.m. and 7 a.m., traffic increases from 11% 
to 24%. The reason for this could be attributed to 
users working at odd hours more often, but it could 
also be caused by international students who use 
these resources from home (mostly from Latin 
America and East Asia, as indicated by the AS 
numbers from which these connections originate). 

Analysis of the traffic in/out ratio. The traffic ratio for 
ingress against egress, demonstrating a significant 
shift in the ratio following the lockdown has been 
studied. Before the shutdown, during workdays, the 
amount of incoming traffic may be up to 15 times 
more than the amount of exiting traffic. The ratio 
halves during the transition phase, reaching its lowest 
point during the third week of online lectures, when 
the weekend vs. workday trend is no longer 
discernible. The nature of remote employment 
explains this shift in traffic asymmetry. The rise in 
outbound traffic can be attributed to users connecting 
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to the network services primarily to access resources. 
Analysis at the connection level. We conduct a 
connection-level analysis, concentrating on particular 
traffic classes, to gain a deeper understanding of the 
traffic movements. We use the AS numbers of all 
endpoints, interfaces, and port pairs to identify if the 
connections are inbound or outgoing. An "incoming" 
connection, for example, is one that is made from a 
home internet provider to an HTTPS server that is 
located within the school network. 39% of the flows 
at this academic network, many of which seem to be 
P2P-like applications, rudimentary protocols, and 
unknown port numbers, for which we are unable to 
reliably detect the directionality. Comparing the pre- 
lockdown baseline (ratio of median daily connections 
before and after March 11, 2020) to the total number 
of connections following the state of emergency 
proclamation, the median number of connections 
increases by 24%. The typical variations between 
workdays and weekends also diminish, but they are 
still discernible over the Easter holiday [50]. When 
examining the directionality of the connections, we 
see that following the lockdown, the median number 
of incoming connections doubles while the number 
of outbound connections is nearly half. This confirms 
the findings from the volumetric study and is a direct 
result of users needing to access services hosted at 
academic networks from the outside. There was a 
significant change in the traffic observed for both 
uploading and downloading internet services, as was 
indicated in the volumetric study. Although there is 
still a discernible shift in the typical working hours, 
such as a decrease in connections at lunch, a sizable 
portion of users now access these services both late at 
night and early in the morning following the COVID- 
19 epidemic. Time zone variations are actually 
apparent. From 10 a.m. to 9 p.m., national users can 
access university-hosted web resources, with a valley 
between 2:00 and 4:00 p.m. Users from Maharashtra, 
Delhi, Rajasthan begin to join about 5:00 p.m. 
displaying a peak from 7 P.M. to midnight (the peak 
hours are 8 and 9 P.M. It's interesting to note that 
although the time trends for VPN, web, and SSH 
traffic patterns are erratic, and remote desktop are 
associated Conclusion. Academic networks see sharp 
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changes in traffic patterns because traffic volume, 
directionality ratios, and source in relation to 
COVID-19and destination have drastically changed 
since COVID-19. This behavior is opposite to the one 
seen yet complementary to it in ISPs for homes. 
8. Section IV 
8.1. Congestion Management 
The problem of congestion is since day of inception 
of network and will remain forever, however the 
techniques to manage the congestion needs to be 
change as per requirement. The definition of 
congestion has not yet been defined by anyone; 
however, the best definition says that it is prospective 
of the user. Whenever a user experience slow 
browsing in the network one may conclude that the 
network is congested. The interesting thing is that the 
management of congestion is not under the control of 
user. The management is getting carried out at ISP 
end or by the management devices mounted at either 
ISP end or user end. The first algorithm proposed by 
Van Jacobson which is getting used till date in 
number of domains state that whenever congestion 
occurs slow start exponential growth will take place 
which manages the traffic to a large extent. From this 
algorithm to till date a number of algorithms has been 
suggested and implemented out of which some are 
listed below: - 
1. Random Early Detection (RED), 
2. Adaptive RED (ARED), 
3. Gentle RED (GRED), 
4. Adaptive GRED (AGRED), 
5. Dynamic GRED (DGRED), 
6. Best Linear Unbiased Estimator (BLUE), 
7. Dynamic threshold-based BLUE (DT BLUE), 
8. GREEN, 
9. Adaptive CHOKE, 
10. ERED, 
11. Subsidized RED (Sub RED) 
12. Non-linear Random Early 
(NLRED) 
13. Reconfigurable Non-Linear Gentle Random 
Early Detection (RNLGRED) and many more 
[6]. 
14. CUBIC (Cubic Binary Increase Congestion 
control) 


Detection 
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The problem with all such algorithm is that they were 
define and designed for the statistic which was 
happened in past but none of them were designed for 
the surge traffic generated during Corona pandemic 
and traffic which may likely to happen in 
forthcoming days if such scenario may generate. 
Thus, in order to manage such heavy unpredictable 
traffic, especially which may consume more 
bandwidth with less latency and jitter a real time self- 
adaptive algorithm is proposed which may manage 
the above-mentioned problems. An analysis of five 
existing algorithms has been carried out based on 
certain parameters and based on data collected from 
various resources as well as through Wireshark 
Version 4.2.2 (v4.2.2-0-g404592842786) a 
comparative study has been carried out. After 
analysis using data before corona pandemic period, 
during the pandemic period and after the pandemic it 
has been concluded that most of the ISP fails to 
support the requirement of the customer during the 
pandemic period. The congestion control algorithm 
did not support the problem that occurred due to 
surge traffic generated during the period. For this 
experiment data available at 
https://www.statista.ccom and is made publicly for 
research and analysis purpose has been used. The 
comparison of some working protocols has been 
carried out under this scenario. For this the ISP 
routers, Gateways, Firewall or UTMs were used 
which were using various protocols for management 
of congestion [51]. It is also found that most of the 
devices were using static as well as predefined 
algorithms which show different results during, 
previously and after the pandemic period. We used a 
fixed delta value in our first test, which was a 
competitive mode-free implementation of Computer 
Operating and Programming Assistant (COPA). The 
findings below, which we evaluated with the CUBIC 
and BBR [53] vl congestion control algorithms, 
show that a delta value of 0.06 offers a suitable 
quality vs. latency trade-off for the application. 
Linux's default congestion control method, CUBIC, 
is widely used. It increases CWND until packet loss 
occurs, at which point it backs off by multiplicatively 
decreasing CWND. However, it has certain known 
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problems, notably buffer bloat, which causes latency, 
and the saw tooth-like, erratic transmission pattern it 
offers. Google's more recent BBR algorithm modifies 
sending rate to find the ideal balance between 
bandwidth and delay after modelling the network 
path using bottleneck bandwidth and RTT. In our 
QUIC (Quick UDP _ Internet Connections) 
implementation, all three implementations (COPA, 
CUBIC, and BBR) are available. 

9. Results 

The bulk of sessions for Facebook Live videos came 
from the United States, Mexico, India, Indonesia, 
Vietnam, and Thailand. We conducted A/B testing to 
evaluate the effectiveness of Facebook Live videos 
from all over India. We concentrated on the following 
application metrics for every video in our 
experiments: Total application bytes transferred 
during broadcast divided by broadcast duration yields 
the average good put. Please be aware that Facebook 
Live sessions can last anywhere from a few seconds 
to several minutes, and that the program modifies bit 
rate based on queue sizes and good put 
measurements. Our ability to deliver better quality 
increases with increased good put. Retransmissions 
result in lower good put since the bytes don't reflect 
any new application bytes, so they don't boost good 
put. An approximation of the average application 
seen latency is the live ingest latency. The application 
sends a little fake payload to the server once every 
second and watches for a response. To get the average 
app round-trip time (RTT), we measure this and 
average it over the course of the session. Diminished 
app RTT translates to reduced video ingest delay if 
bit rate is the same or greater. Using the application 
observed RTT, we were able to evaluate video 
latency in our experiments, and we discovered that 
COPA consistently offered lower latency than 
CUBIC. BBR reduced more than COPA for sessions 
with an apparently decent network and low latencies 
already calculated. Zoom App RTT decreased by 7 
percent with COPA and 12 percent with BBR, from 
378 ms for CUBIC to 368 ms for COPA and 342 ms 
for BBR. COPA, however, significantly reduced 
latencies for sessions with weaker networks. Zoom 
App RTT decreased by 24% with COPA, from 6.4 
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seconds for CUBIC to 4.9 seconds for COPA, while 
BBR reductions began to taper down [52]. In the 
majority of real-world situations, sacrificing some 
quality allows us to lower latency. When there are 
network bottlenecks, video latencies will 
automatically decrease if we reduce video bit rate, 
that is, write less on the wire and reduce quality. The 
good put figures for the three groups were compared, 
and we discovered that COPA and BBR 
outperformed CUBIC in terms of good put. This 
indicates that in addition to lowering application 
latency, COPA and BBR enabled the program to 
provide higher-quality video. The number of videos 
seen overall changed as a result of this development, 
which was substantial. Google meet, and online video 
App good put was enhanced by 8.2 percent by COPA 
and 6.8 percent by BBR. The good put was increased 
by 6.8 percent by BBR and 19.8 percent by COPA. 
It should be noted that although the benefits appear to 
decrease for online video conferencing and some 
others, this is just because the encoder bit rate for this 
experiment was limited to 100 Mbps. Let's take a look 
at some lower-level indicators to see where these 
increases originated. We concentrated on calculating 
the QUIC transport's RTT and _ retransmission 
overhead during the transport implementation. Keep 
in mind that the round-trip time of a packet is 
measured by the application RTT after it leaves the 
application layer, whereas the round-trip time of a 
packet is measured by the former after it is written 
over the wire. Additionally, the application RTT 
conceals retransmissions; that is, in the event of a 
packet loss, multiple roundtrips at the transport layer 
will be required [39]. 
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Figure 7 Best Connections 
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Figure 8 Worst Connections 


9.1. Average Transport RTT Comparison 
For the best connections (three ISP and three [XP), 
BBR gave us the lowest transport RTTs, continuing 
the trend of improvements in application RTT. 
However, as the RTTs for those customers were 
already quite low, the drop wasn't that significant. It 
is evident from the most data that COPA gave the 
lowest values in this case. Whereas COPA reduced 
RTT by 36 percent, BBR reduced it by 12 percent. 
The conventional traffic was lowered even more 
significantly: BBR lowered it by 18%, while COPA 
lowered it by an astounding 40%. Some of the 
observed improvements in video delay can be 
explained by lower transport RTT. It's important to 
remember that application RTT (video latency) is 
also influenced by the amount of data the application 
sends based on ABR, which has an impact on the 
amount of data queued in the transport send buffer. It 
is therefore plausible that some of the latency 
reduction from reduced transport RTT was offset by 
greater quality output from the ABR due to enhanced 
transport. However, after a packet leaves the 
transport, the amount of data queued in the 
underlying network determines how much the 
transport RTT varies. Figure 7, 8 and 9 shows the 
Comparison of Goodput at various intervals. 
9.2. RTX Overhead Comparison 

We examined the amount of data that is lost and 
retransmitted in order to better understand the 
behavior of the transport system. This metric's 
precise definition is as follows: Total bytes 
retransmitted by the transport / Total bytes 
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acknowledged equals RTX Overhead [54]. It was 
discovered that BBR had less overhead overall for all 
users than CUBIC. For about 90% of users, it's about 
half that of CUBIC. The variance in overhead 
between COPA and CUBIC is significant. For about 
75% of users, COPA has a quarter of the overhead. It 
begins to rise as you get into tail cases, surpassing 
CUBIC to become four to five times more for tail 
cases. When COPA detects an increase in queueing 
delay, it proactively lowers CWND rather than 
treating loss as a congestion indicator. The concept is 
that COPA's queuing delay measures will rise when 
a bottleneck queue fills, allowing us to detect 
congestion before any loss occurs. Therefore, for 
COPA, we should always experience considerably 
lesser packet loss. In fact, this is what we observe for 
almost 80% of users. Nonetheless, the final 20% of 
users had significantly higher loss, suggesting that 
there was no correlation between loss rates and 
queueing delays for these users. We looked at these 
cases’ behavior in greater detail and discovered 
evidence of network policing, which is covered in the 
section that follows. 


Goodput comparison 


Nov-Jan20 feb -17 Mar 


Hl copa 
ed) BBR 
Wi cusic 


19th March- April-May July-Sep Oct-Dec 


Figure 9 Comparison of Goodput at Various 
Intervals 
Suggested for 
congestion 
Network policing is the process of isolating and 
monitoring traffic from a single source in order to 
throttle it at a specific rate. Any additional packets 
that are above that rate will be tail dropped by the 
provider under the standard policing procedure [55]. 
This leads to a few traits that set it apart from losses 


algorithm management of 


International Research Journal on Advanced Engineering Hub (IRJAEH) 


e ISSN: 2584-2137 
Vol. 02 Issue: 04 April 2024 
Page No: 715 - 733 


https://irjaeh.com 
https://doi.org/10.47392/IRJAEH.2024.0 102 


brought on by congestion: 

e Reliable throughput or Goodput 

e Extremely large losses 

e Reduced RTT and waiting times 
While COPA had a larger tail retransmission 
overhead than CUBIC and BBR, tail RTT was lower. 
This fit with a few aspects of traffic enforcement. 
Since traffic policing typically differs greatly by ASN 
provider, we first broke down the results by ASN to 
make sure the same may get implemented easily. As 
it turned out, RTX overhead did differ significantly 
amongst ASNs. We _ discovered evidence of 
significantly increased RTX overhead for COPA in 
some ASNs, where we also observed indications of 
traffic policing in an independent analysis. We 
displayed the link between RTT, queuing time, and 
RTX overhead to validate our theory. The graph's 
first half shows how, with COPA, RTX overhead 
rises along with RTT and queuing delays. Given that 
these losses are accompanied by longer wait times, it 
is evident that traffic is the real cause of the 
congestion in this area. However, in the second half 
of the graph, RTT and queuing delays begin to 
decrease after reaching a maximum. In reality, users 
notice relatively little delay in the location with the 
largest RTX overhead. This supported our hypothesis 
that network policers are probably to blame for the 
large losses. Though the network properties and 
remedies are extremely similar, note that short 
buffers might also be the cause of this. However, as 
RTX overhead rises for CUBIC, RTT and queuing 
delays keep getting longer. This suggests that 
congestion is the cause of all user losses, which 
makes sense as CUBIC interprets loss as a signal for 
congestion and adjusts CWND appropriately. 
10. Discussion 
The requirement mostly on online services at the start 
of the pandemic caused network operators to worry 
about, among other things, maintaining the smooth 
operation of networks, particularly for vital 
institutions like hospitals, defense and 
pharmaceuticals [5]. According to our investigation 
from every angle, the pandemic actually raised 
demand for such congestion management algorithms 
that facilitate remote learning, video conferencing 
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without delay and jitter buy supporting required 
bandwidth and work to ensure social separation. 
Because cloud services are elastic and flexible, and 
because cloud providers are becoming more 
connected, the Internet can handle this additional 
demand [7, 10, 37, 58, and 25]. Our findings verify 
that cloud-based applications account for the majority 
of those with the biggest absolute and relative gains. 
Moreover, the seamless transition to the new normal 
was made possible by the implementation of best 
practices for network design, operation, and 
provisioning. It was able to handle the rise in demand 
because of the advancements in high speed and ULSI 
based hardware with self-learned and decision 
making network [21]. Most ISP as well as IXP fails 
to manage the heavy demand initially and hence the 
internet services hampered in first few days but later 
on manage the same. All such mismanagement 
occurs due to heavy demand in video and audio 
services. The various functioning algorithms tries 
their best to manage the congestion occurred at 
routers, gateways, firewalls or UTMS but fails to 
manage in full fleshed manner. Mostly made a trade- 
off between various parameters such as In 
conclusion, our research shows that in order to create 
resilient networks that can withstand sharp and 
unforeseen fluctuations in demand,  over- 
provisioning, network management, and automation 
are essential in order to reducing the rise of traffic. In 
this research, we report a 15-20% spike in traffic 
within a few days of the lockdown starting. This is 
consistent with reports from IXPs [56], CDNs [18, 
35, 42, 43], and ISPs [34, 36]. ISPs and CDNs are 
usually ready for a thirty percent growth in traffic in 
a single year [8, 14, and 39]. Although these are 
annual plans, the epidemic brought about significant 
changes in a matter of days. ISPs were therefore 
forced to either add capacity very fast or take 
advantage of over-provisioned capacity, for example, 
to accommodate unanticipated traffic surges like 
attacks or flash-crowd events. At the [XP-CE alone, 
we Saw port capacity increases of about 1,500 Gbps 
(3%) across numerous [XP members. Outside of our 
datasets, several networks disclosed in the open that 
the pandemic's effects on traffic shifts caused partial 
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connectivity problems and necessitated the creation 
of additional linkages [22, 57]. We see that the 
growth is significantly smaller when we focus on 
traffic peaks. On one side it is concluded that the 
pandemic effect the traffic especially in video, audio 
and OTT platform which affect our vantage points' 
network operation; on the other hand, some links see 
large surges in traffic, far above the average 15-20%. 
Some network operators may find themselves in need 
of port improvements as a result of these sudden 
surges. Conversely, the perspectives presented in this 
study span from very big to moderately sized 
organizations with ample resources and a wealth of 
network resilience and provisioning expertise. From 
an operational standpoint, the pandemic response has 
necessitated certain port capacity upgrades, but not 
significantly. The fact that network operators can 
swiftly expand capacity, when necessary, shows how 
well the Internet infrastructure functions overall, 
even with the lockdown's restrictions on access to 
data centers. This is a notable change in Internet 
traffic that, based on our experience, the Internet core 
as a whole is able to handle surprisingly effectively. 
This is presumably because a large number of 
operators are ready and able to respond swiftly to new 
demands Although the pandemic is an extreme and 
unique instance, it may be argued that as the Internet 
and contemporary life become more intertwined, 
these kinds of events could happen more frequently. 
Either way, the COVID-19 epidemic emphasizes 
how quickly user behavior may shift and how 
network operators must be ready with unforeseen 
demand fluctuations [9]. 

Conclusion 

The COVID-19 pandemic is an uncommon event 
that, hopefully, will only happen once in a lifetime. It 
significantly altered social and work patterns for 
billions of people. Nevertheless, life went on because 
of our societies' greater digitalization and resilience, 
with the Internet serving as a vital source of support 
for social connections, commerce, education, and 
entertainment. In this paper, we examined network 
flow statistics from several angles: three IXPs 
situated in Central India and the western part which 
serve as the core, while a sizable academic network 
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and a sizable ISP are situated at the periphery. When 
taken as a whole, they help us comprehend how 
Internet traffic in more developed nations is affected 
by lockdowns. Our research highlights the 
significance of utilizing many perspectives to 
completely comprehend the COVID-19 pandemic's 
effects on traffic. Traffic is heavier in the mornings 
and late at night. The differences between workday 
and weekend traffic patterns are becoming less and 
less noticeable. Traffic to VPN and _ video 
conferencing apps for distant work and education has 
increased by more than 200%. In some areas of the 
Internet, like educational networks that service 
college campuses, we observe a sharp rise in some 
apps that facilitate distant learning and working, but 
a sharp decline in traffic needs because of user 
absence. We note that traffic ratios for several 
networks, both sources and destinations, change 
significantly from what would be expected in a world 
prior to the COVID-19 epidemic these findings 
emphasize how crucial it is to approach traffic 
engineering from a perspective that considers 
"essential" applications for remote working in 
addition to popular traffic classes and hypergiant 
traffic. The data collected from various resources 
during the research it has been concluded that Internet 
traffic is intended and unseen surge traffic with 
variation in dscp traffic pattern However, related 
research revealed a decline in performance in less 
developed areas [3]. The unexpected traffic shifts 
brought about by the imposition of confinement 
measures highlight how crucial the distributed 
character of the Internet is for facilitating civil 
responses to such incidents and bolstering societal 
resilience. In overall as the traffic has migrated to real 
time video and audio demand which is totally 
different from the time period previous to pandemic 
period the solution to manage the congestion needs to 
be modify. In the forthcoming days the conventional 
entertainment channel will migrate towards OTT 
platform, academics will be on hybrid mode, 
meetings will be more on on-line platforms ChatGPT, 
and others force researchers to develop a more robust 
algorithm. 
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